Block Domain - FireEye Email Security

This playbook blocks domains using FireEye Email Security. The playbook checks whether the FireEye Email Security integration is enabled, whether the Domain input has been provided and if so, blocks the domain.

FireEye Email Security (EX) · 5 tasks · 1 input · 0 outputs

Details

ID	`Block Domain - FireEye Email Security`
From Version	6.0.0
Tasks	5

README

This playbook blocks domains using FireEye Email Security.
The playbook checks whether the FireEye Email Security integration is enabled, whether the Domain input has been provided and if so, blocks the domain.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

FireEyeEX

Scripts

This playbook does not use any scripts.

Commands

fireeye-ex-create-blockedlist

Playbook Inputs

Name	Description	Default Value	Required
Domain	The Domain to block.		Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Block Domain - FireEye Email Security

Inputs

Domain — The Domain to block.

Commands used

fireeye-ex-create-blockedlist

Flowchart

Source

playbook-Block_Domain_-_FireEye_Email_Security.yml

Download History Raw

id: Block Domain - FireEye Email Security
version: -1
name: Block Domain - FireEye Email Security
description: |-
  This playbook blocks domains using FireEye Email Security.
  The playbook checks whether the FireEye Email Security integration is enabled, whether the Domain input has been provided and if so, blocks the domain.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 94163ae0-f7a8-4641-803d-11ce2e35a27a
    type: start
    task:
      id: 94163ae0-f7a8-4641-803d-11ce2e35a27a
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: e1a529d9-ad4c-4392-8249-128a5b760eba
    type: condition
    task:
      id: e1a529d9-ad4c-4392-8249-128a5b760eba
      version: -1
      name: Is FireEye Email Security  enabled?
      description: Verify that there is a valid instance of Check Point Firewall enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: FireEye Email Security
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: Active
                    ignorecase: true
                accessor: brand
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 670,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: a3c34dcc-8863-4c06-88d6-10416932bdd1
    type: regular
    task:
      id: a3c34dcc-8863-4c06-88d6-10416932bdd1
      version: -1
      name: Block Domain
      description: Creates the blocked sender domain.
      script: '|||fireeye-ex-create-blockedlist'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      entry_value:
        complex:
          root: inputs.Domain
      type:
        simple: sender_domain
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 860,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 3b6ec932-ffb3-43c5-8666-13b769935c00
    type: title
    task:
      id: 3b6ec932-ffb3-43c5-8666-13b769935c00
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 8a98155b-9114-4772-8676-5dea5fa7809c
    type: condition
    task:
      id: 8a98155b-9114-4772-8676-5dea5fa7809c
      version: -1
      name: Check if Domain input was provided
      description: Check whether the necessary inputs were provided
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Domain
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "1_2_yes": 0.66
    },
    "paper": {
      "dimensions": {
        "height": 725,
        "width": 790,
        "x": 450,
        "y": -100
      }
    }
  }
inputs:
- key: Domain
  value: {}
  required: false
  description: The Domain to block.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.0.0